Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CNG Isolation Now Assistant Error Diagnostic' = 'C:\tikbqrzmltr\zbmbhqeccgq.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Debugger Topology UserMode IKE] 'ImagePath' = 'C:\tikbqrzmltr\zbmbhqeccgq.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Debugger Topology UserMode IKE] 'Start' = '00000002'
Modifies file system:
Creates the following files:
- C:\tikbqrzmltr\zbmbhqeccgq.exe
- C:\tikbqrzmltr\vveshfkrxcgy.exe
- C:\tikbqrzmltr\plr2obvsjgzwspwuwfn.exe
- %WINDIR%\tikbqrzmltr\ctppgrxris
- C:\tikbqrzmltr\ctppgrxris
Sets the 'hidden' attribute to the following files:
- C:\tikbqrzmltr\vveshfkrxcgy.exe
- C:\tikbqrzmltr\zbmbhqeccgq.exe
Deletes the following files:
- C:\tikbqrzmltr\plr2obvsjgzwspwuwfn.exe
- %WINDIR%\tikbqrzmltr\ctppgrxris
Substitutes the following files:
- %WINDIR%\tikbqrzmltr\ctppgrxris
Network activity:
Connects to:
- 'ge####manbottom.net':80
- 'al####ybottom.net':80
- 'fo####beyond.net':80
- 'al####ybeing.net':80
- 'ge#####anforever.net':80
- 'al####yforever.net':80
- 'me####beyond.net':80
- 'me####forever.net':80
- 'fo####bottom.net':80
- 'me####bottom.net':80
- 'fo###wbeing.net':80
- 'me###rbeing.net':80
- 'fo####forever.net':80
- 'ex#####ncebeyond.net':80
- 'fr###being.net':80
- 'ex####encebeing.net':80
- 'se####lshoulder.net':80
- 'ma#####lshoulder.net':80
- 'fr###beyond.net':80
- 'fr####orever.net':80
- 'ge####manbeyond.net':80
- 'al####ybeyond.net':80
- 'ge####manbeing.net':80
- 'ex#####nceforever.net':80
- 'fr###bottom.net':80
- 'ex#####ncebottom.net':80
TCP:
HTTP GET requests:
- http://ge####manbottom.net/index.php
- http://al####ybottom.net/index.php
- http://fo####beyond.net/index.php
- http://al####ybeing.net/index.php
- http://ge#####anforever.net/index.php
- http://al####yforever.net/index.php
- http://me####beyond.net/index.php
- http://me####forever.net/index.php
- http://fo####bottom.net/index.php
- http://me####bottom.net/index.php
- http://fo###wbeing.net/index.php
- http://me###rbeing.net/index.php
- http://fo####forever.net/index.php
- http://ex#####ncebeyond.net/index.php
- http://fr###being.net/index.php
- http://ex####encebeing.net/index.php
- http://se####lshoulder.net/index.php
- http://ma#####lshoulder.net/index.php
- http://fr###beyond.net/index.php
- http://fr####orever.net/index.php
- http://ge####manbeyond.net/index.php
- http://al####ybeyond.net/index.php
- http://ge####manbeing.net/index.php
- http://ex#####nceforever.net/index.php
- http://fr###bottom.net/index.php
- http://ex#####ncebottom.net/index.php
UDP:
- DNS ASK al####ybottom.net
- DNS ASK fo####beyond.net
- DNS ASK me####beyond.net
- DNS ASK ge####manbottom.net
- DNS ASK al####ybeing.net
- DNS ASK ge#####anforever.net
- DNS ASK al####yforever.net
- DNS ASK fo####bottom.net
- DNS ASK me####bottom.net
- DNS ASK be###beyond.net
- DNS ASK me####forever.net
- DNS ASK fo###wbeing.net
- DNS ASK me###rbeing.net
- DNS ASK fo####forever.net
- DNS ASK ge####manbeing.net
- DNS ASK fr###beyond.net
- DNS ASK ex#####ncebeyond.net
- DNS ASK fr###being.net
- DNS ASK ma####alfinger.net
- DNS ASK se####lshoulder.net
- DNS ASK ma#####lshoulder.net
- DNS ASK se####lfinger.net
- DNS ASK ex#####ncebottom.net
- DNS ASK ge####manbeyond.net
- DNS ASK al####ybeyond.net
- DNS ASK fr###bottom.net
- DNS ASK ex####encebeing.net
- DNS ASK fr####orever.net
- DNS ASK ex#####nceforever.net
Miscellaneous:
Creates and executes the following:
- 'C:\tikbqrzmltr\vveshfkrxcgy.exe' "c:\tikbqrzmltr\zbmbhqeccgq.exe"
- 'C:\tikbqrzmltr\zbmbhqeccgq.exe'
- 'C:\tikbqrzmltr\plr2obvsjgzwspwuwfn.exe'
